Static task
static1
Behavioral task
behavioral1
Sample
6ac72c83ea2539e391e8a6a9d1f8ac51_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6ac72c83ea2539e391e8a6a9d1f8ac51_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
6ac72c83ea2539e391e8a6a9d1f8ac51_JaffaCakes118
-
Size
100KB
-
MD5
6ac72c83ea2539e391e8a6a9d1f8ac51
-
SHA1
951968162a832f3d9e0d493a4ade9faf9010f230
-
SHA256
42104382c26a5ad5828623e935bc21215b7190f3584aad0f88f88562f11286a6
-
SHA512
9d5ff0964a239a3bae350cf99831d445aa92e15eb99eed8998b2d68ef99a721063bde6ef69b20e270dc7b9081d6d1400ea9c646bb3594103c5b2a7fb89da00cf
-
SSDEEP
1536:9ZEsJL9UWac6CfwI1jMbJy/WhrkpEFhbqWPCkRYav+r744o153njcAok:HEKUxVCheJyYrwELDPCpav+rkjjx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6ac72c83ea2539e391e8a6a9d1f8ac51_JaffaCakes118
Files
-
6ac72c83ea2539e391e8a6a9d1f8ac51_JaffaCakes118.dll windows:4 windows x86 arch:x86
bcc4c96c7545f3af0e5a21457b229c6a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
RegOpenCurrentUser
RegEnumValueW
ReadEncryptedFileRaw
OpenProcessToken
LsaStorePrivateData
GetSecurityDescriptorGroup
GetMultipleTrusteeW
user32
MoveWindow
MessageBoxA
KillTimer
RegisterWindowMessageA
GetDlgItem
GetClassLongA
DrawTextA
DeleteMenu
ReleaseCapture
SetCursor
UpdateWindow
IsIconic
shlwapi
PathRemoveExtensionW
PathRemoveBlanksA
PathIsSystemFolderA
PathGetDriveNumberA
oleaut32
VarBstrCat
VarBstrCmp
SafeArrayAccessData
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayDestroy
netapi32
NetReplImportDirDel
NetServerComputerNameAdd
DsAddressToSiteNamesExW
NetJoinDomain
NetLocalGroupDel
kernel32
GetCommandLineA
ExitProcess
DebugActiveProcess
CloseHandle
GetModuleHandleA
GetStartupInfoA
GetSystemWindowsDirectoryW
GetTapeStatus
SetTimerQueueTimer
SetLocaleInfoA
OpenFileMappingA
IsValidCodePage
HeapCreate
HeapAlloc
GetVolumeNameForVolumeMountPointA
GetVersionExA
dbghelp
SymGetSymFromAddr64
SymGetLineFromAddr64
SymEnumSym
SymGetSymFromAddr
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ